Encrypted Drive Data Recovery and Examination

Disk encryption is the right choice for data security. But if the recovery key is lost, was never backed up centrally, or the employee who used the device has left, the organisation may be locked out of its own data.

In that situation the first step is not guessing passwords, but systematically searching the places where the recovery key may be stored.

Do not connect the drive to other computers, change BIOS/UEFI or TPM settings, or try random passwords.

In some configurations these actions can narrow the options for access. Bring the device to us as it is.

• Identification of the encryption product and its configuration
• Search for recovery keys and backup key sources
• Technical analysis of the encryption mechanism
• Password recovery attempts where appropriate
• Forensic imaging once access is gained
• Examination of files, user data and system records on the image
• Assessment of digital findings relevant to the case
• Clear technical reporting of results

We first analyse the encryption technically and investigate whether the recovery key can be obtained from a directory service (such as Active Directory), backup systems or a user account. Where access is gained, we create a forensic image of the drive to preserve the original and carry out the examination on that image.

1. Intake and custody: we confirm the requester's legal authority, sign a non-disclosure agreement and receive the material with a signed evidence handover record. The chain of custody is documented from this point on.
2. Authority and configuration: your authority over the drive is documented and the encryption product and configuration are identified.
3. Key search and access: recovery key sources are searched and, where appropriate, password recovery is attempted; if access is gained, a forensic image is created and its hash value recorded.
4. Reporting and return: findings are reported together with the scope and limitations of the work. The material is returned against a signed record and working copies are either not retained at all or kept for 3 or 6 months, as the client prefers, and then securely destroyed.

Duration varies from case to case depending on the type of device or material, the data volume and the scope of the examination. We share an estimated timeframe after the initial assessment. In some configurations access may not be technically possible; we tell you this clearly after the preliminary review.

Organisations that have lost a recovery key, companies facing access problems after an employee leaves, and parties to legal proceedings.